Separate three decisions
AWeber setup has three practical questions: can you receive the sender-address verification message, has the domain been authenticated, and does the intended list use that sender? A success at one step does not settle the others. Start with a domain you control and a monitored mailbox on it. Record the list, broadcast owner and DNS administrator before changing records.
The provider's sending-address guide directs you to add an address in Domains and Addresses and follow its verification email. In List Settings, Basic Settings, choose the verified address from the From Address list and save. Sending-address workflow
Configure the domain deliberately
AWeber offers automatic connection and a manual path. For manual setup, open the domain's gear icon in Domains and Addresses, obtain its DKIM CNAME records and DMARC instruction, and publish through the authoritative DNS service. Return to the same domain view to check the Installed statuses. Its automatic path configures both DKIM and DMARC, so review an existing domain policy before granting a connection permission. Authentication instructions
Do not replace an established quarantine or reject policy with a generic monitoring example merely to clear an onboarding screen. Ask the domain owner to reconcile any policy conflict and reporting destination. A new marketing integration should not silently change the treatment of mail sent by finance, support or another platform. If the intended DNS names already exist, compare their use and values before editing.
Build a broadcast release check
AWeber states that it rechecks authentication at broadcast send time and returns an unauthenticated broadcast to Draft. That makes DNS retention part of campaign operations, not a one-time onboarding task. Send-time check
Original operating procedure: before a high-value broadcast, confirm the selected list sender, domain statuses and accountable campaign operator. Then send a controlled message through the same intended workflow. Save its original headers privately and record the visible From domain, envelope sender, DKIM d= and s= identities, and the receiving service's SPF, DKIM and DMARC results. Use results inserted by the trusted receiver, not an arbitrary header carried in the message.
Authentication and inbox placement are different outcomes. The identity test is whether a passing SPF or DKIM result aligns with From under the domain's applicable policy. A test reaching an inbox does not by itself prove that relationship, and a valid identity does not guarantee every recipient will accept a campaign.
Diagnose the right layer
Illustrative scenario: DNS is correct for the marketing domain, but a list still selects an old sender. The domain administrator sees no DNS defect while the campaign owner sees an unexpected address. Compare the actual message and list configuration before rebuilding keys. Conversely, an address verification email proves mailbox access, not that the domain's published records remain intact.
Keep a short exception record with the failing layer, owner and next observation. For DNS trouble, compare public authoritative answers with the account instructions and check owner-name duplication. For address trouble, check mailbox access and the selected list address. For a returned draft, restore authentication before rescheduling; do not assume a prior schedule remains an executed send.
Close and maintain
Preserve previous settings for rollback and pause only the affected campaign while investigating. Recheck after a DNS migration, list ownership change or sender-domain switch. Do not delete authentication records during routine website cleanup without consulting the campaign owner. Documentation was reviewed on 8 November 2026; no AWeber tenant, broadcast or live DNS record was tested for this guide.
Work the list-selection decision explicitly
Written case AW-01 assumes the intended list is Product Updates, its approved sender is news@example.com, but its saved From is news@oldbrand.example. Only example.com has a current Installed status in the case; oldbrand.example authentication is unknown. The campaign owner must correct or explicitly approve the actual sender and verify that domain before scheduling. Do not infer a DMARC result from the green status of a different domain. For a later hypothetical controlled message, suppose From news@example.com and a trusted DKIM pass with d=example.com, s=aweber_key_a; that is an exact aligned path even though SPF remains unknown. It still says nothing about a future broadcast after DNS removal. No list, broadcast or message was accessed or executed here.
Preserve the enforcement boundary
RFC 9989 Section 7.4 requires valid DKIM, not SPF alone, for domains publishing p=reject, and warns about indirect-mail and mailing-list interoperability. A single successful direct-message test is not proof that every legitimate route is ready for stronger policy. Keep existing approved protection while diagnosing the actual gap; any policy change needs its own decision.